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ABSTRACT 

The  feasibility  of  applying  the  Flight  Safety  Prediction  Technique 
to  rotary  wing  aircraft  Is  demonstrated  through  its  application  to  the 
UH-1N  helicopter.  A complete  safety  model,  compatible  with  the  com- 
puter program  used  for  a fixed  wing  aircraft.  Is  presented. 
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GLOSSARY 


Safety-related  terms  used  In  this  report  are  defined  below.  Certain  of  these 
terms  are  expressed  In  somewhat  different  words  later  In  the  text,  depending  on  the 
context  of  the  discussion;  but  the  meaning  will  be  consistent  with  the  definitions  given 
here. 


Criticality 


Dependency 


FSPT 


Flight  phases 


- A numerical  index  of  the  significance  of  equipment 
failure  history  relative  to  aircraft  safety.  As  an 
analysis  parameter,  criticality  can  be  considered 
proportional  to  the  likelihood  that  an  item  will  fail 
and  thereby  cause  an  accident.  It  is  the  product  of 
the  failure  probability  and  the  sensitivity  of  an 
equipment  item. 

- See  "link  dependency". 

- Flight  Safety  Prediction  Technique 

- Discrete  segments  of  the  aircraft  mission  profile. 
For  rotary  wing  aircraft,  the  flight  phases  are 
defined  as  1)  startup  and  taxi,  2)  takeoff,  3)  climb, 
4)  cruise,  5)  tactics,  6)  cruise,  7)  descent,  8)  land, 
and  9)  taxi  and  shutdown. 


Functional  analysis  - 


Functional  path 


Link  dependency 


Provisory  condition  - 


Provisory  factor  — 


The  determination  of  equipment  relationships  to  air- 
craft functions  performed,  and  the  interrelationships 
of  these  functions. 

The  compilation  of  functional  relationship  in  which 
one  function  is  identified  as  being  dependent  upon 
another. 

The  conditional  probability  of  a dependent  function 
failing,  given  that  a particular  function  it  is 
dependent  upon  has  failed. 

Operation  of  an  aircraft  in  a mode  or  environment 
such  that  the  safety-related  importance  of  certain 
equipments  is  increased.  Provisory  conditions 
include  icing,  night  flights,  supersonic  flight,  etc. 

The  probability  that  a provisory  condition  exists. 
Also  used  to  describe  the  coded  notation  serving  to 
indicate  that  a functional  relationship  is  dependent 
on  a particular  provisory  condition. 
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Safety  sensitivity 
Sensitivity 


- Same  as  "sensitivity". 

- A quantitative  indication  of  the  degree  of  safety 
degradation  to  be  expected  if  a function  or  equipment 
fails.  The  more  specific  terms  are  "functional 
sensitivity"  or  "equipment  item  sensitivity". 
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This  document  Is  part  of  a lfi-volume  report  describing  the  application  to 
specific  aircraft  of  AR1NC  Research  Corporation's  Flight  Safety  Prediction  Technique 
(FSPT).  The  technique  was  developed  under  previous  Air  Force  contracts  (see 
Appendix  A).  The  present  effort,  undertaken  In  1972  under  Contract  F09603-72-1132- 
SA01,  has  led  to  further  refinement  of  the  FSPT  through  Its  broad  application  to  many 
different  types  of  aircraft.  The  flight  safety  models  generated  for  these  aircraft  are 
presented  In  Individual  volumes  of  this  report  as  follows: 
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Volume 

Aircraft 

Volume 

Aircraft 
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B-52G,  H 

li 
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Volume  1, 
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contract  period. 
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SUMMARY 


This  study  concerned  the  feasibility  of  applying  the  Flight  Safety  Prediction 
Technique  to  rotary  wing  aircraft.  It  was  found  that  the  model  developed  for  fixed 
wing  aircraft  was  applicable  to  helicopters  without  change  to  the  basic  mathematical 
structure  or  computer  process.  No  change  in  data  requirements  are  necessary,  since 
the  same  screening  methods  are  used  to  generate  the  UH-1N  malfunction  rate  as  for 
other  aircraft. 

To  assure  that  the  study  fully  documented  all  aspects  of  a model  of  a rotary-wing 
aircraft,  and  that  the  model  would  perform  as  for  previous  fixed-wing  models,  a 
specific  helicopter  type  — the  UH-1N  — was  chosen  for  analysis. 

Primary  areas  of  modification  to  the  FSPT  to  accommodate  rotary  wing  aircraft 
included: 

a.  Redefinition  of  certain  upper  level  functions  in  accordance  with 
rotary-wing  systems  operation. 

b.  Redefinition  of  flight  phases  to  conform  with  rotary-wing  mission 
profiles. 

c.  Review  of  sensitivity  assignments  in  light  of  autorotative  and 
"land-most-anywhere"  criteria. 

d.  Redefinition  of  a provisory  factor. 
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INTRODUCTION 


1. 1 BACKGROUND 

The  Flight  Safety  Prediction  Technique  developed  by  ARINC  Research 
Corporation  provides  for  assessment  of  the  Impact  on  flight  safety  of  the  failure  of 
specific  Items  of  equipment  within  an  aircraft.  In  the  FSPT,  mathematical  modeling 
procedures  are  applied  for  processing  aircraft-equipment  failure  data  to  yield  a 
quantified  Index  ranking  safety-related  problems  on  the  basis  of  their  likelihood  of 
occurrence  and  the  resulting  degradation  In  the  aircraft's  capability  to  fly. 

The  ranking  factor  Is  called  "criticality",  which  In  its  simplest  form  is  the 
product  of  the  failure  probability  and  flight  safety  sensitivity  of  an  equipment.  (A 
more  detailed  definition  appears  in  Section  2 and  Appendix  B.)  The  failure  probability 
Inputs  are  from  basic  failure  data  sources,  AFM  66-1  and  65-110.  The  sensitivity 
estimates  are  derived  by  the  following  process: 

a.  Systematic  analysis  of  aircraft  functions  to  determine  those  essential  to 
flight  safety; 

b.  Identification  of  the  hardware  required  to  perform  these  functions; 

c.  Evaluation  of  the  safety  significance  of  the  hardware  in  performing  these 
essential  aircraft  functions. 

The  criticality  values  resulting  from  this  approach  provide  a relative  ranking  of 
all  malfunctions  with  respect  to  their  safety  significance.  Figure  1-1  is  a simplified 
example  of  how  three  equipment  items  would  be  ranked  on  the  combined  basis  of  their 
failure  probability  and  safety  sensitivity. 

The  methodology  has  the  ability  to  rank  malfunction  problems  currently  and  con- 
tinuously by  their  accident  potential.  This  ranking,  based  on  criticality  assessment 
can  provide  the  basic  parameters  necessary  for: 

a.  Identifying  equipment  items  whose  failure  history  and  application  pose  a 
threat  to  aircraft  safety; 

b.  Quantifying  the  degree  of  threat  associated  with  each  equipment  item; 

c.  Evaluating  and  tracking  the  effectiveness  of  modifications  to  the  aircraft; 

d.  Assessing  safety  benefits  versus  the  cost  of  proposed  aircraft  modifica- 
tions, changes  in  maintenance  or  flight  operations,  or  alternative 
aircraft  designs. 
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Figure  1-1.  Example  of  Criticality  Ranking  Process 


1.2  FORMAT  OF  KKPOKT 

In  this  report.  Section  2 will  briefly  describe  the  mathematical  concepts  under- 
lying the  Flight  Safety  Prediction  Technique.  Section  .1  will  discuss  the  model  develop- 
ment and  utilization  of  the  technique  in  application  for  fixed-wing  and  then  for 
rotary-wing  aircraft.  The  similarities  and  differences  will  be  noted.  Section  2 will 
also  discuss  the  general  application  of  these  concepts  to  the  development  of  safety 
models  for  fixed-  and  rotary-wing  aircraft,  while  Section  I describes  application 

activities  related  specifically  to  the  UH-1N  helicopter.  ! 

Appendix  A summarizes  the  contractual  history  of  the  development  of  the  FSPT; 

Appendix  R discusses  (as  a supplement  to  Section  21  mathematical  considerations 
underlying  the  technique;  Appendix  C discusses  FSPT  documentation  methods;  and 
Appendix  I)  presents  functional  relationship  diagrams  and  a listing  of  keypunch  cards 
that  comprise  the  safety  model  documentation  for  the  U1I-IN  helicopter. 
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METHODOLOGY  UNDERLYING  FSPT 
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I 

This  section  discusses  the  basic  definitions  and  mathematical  concepts 
associated  with  the  Flight  Safety  Prediction  Technique. 


2. 1 DEFINITION  OF  SAFE  AIRCRAFT 

To  develop  a relative  measure  of  aircraft  safety  degradation  resulting  from 
specific  equipment  malfunctions,  it  is  first  necessary  to  define  a "safe"  aircraft.  For 
purposes  of  the  FSPT  assessments,  an  aircraft  is  assumed  to  be  In  a safe  condition  if 
it  is  operating  within  its  prescribed  performance  limits.  Conversely,  an  aircraft 
operating  (or  about  to  operate)  outside  these  limits  is  considered  to  be  unsafe,  i.e. , in 
a condition  where  property  damage  and  personal  Injury  may  result. 

The  safety  prediction  methodology  does  not  attempt  to  assess  the  extent  of 
possible  personal  injury  or  aircraft  damage  resulting  from  an  unsafe  condition. 

Neither  does  the  concept  consider  ejection  capability,  parachutes,  life  rafts,  etc. , 
which  do  not  make  an  aircraft  safer  per  se  but  provide  for  the  survivability  of  the  air- 
crew when  the  aircraft  is  unsafe.  Collision  Is  also  excluded  from  consideration 
because  of  the  complexity  of  the  interrelationships  between  pilot,  aircraft  equipment, 
ground  surveillance,  and  traffic  density. 


2.2  MATHEMATICAL  BASIS  OF  FSPT 

The  probability  of  an  accident  caused  by  the  failure  of  an  element  can  be 
expressed  as  the  probability  of  the  element  failing  multiplied  by  the  conditional 
probability  that  the  failure  of  the  element  will  cause  an  accident.  Stated  in  equation 
form: 


where: 

PU.J) 

P(j) 

PMIJ) 


PU.J)  = P(j)PU|j) 


(1) 


Probability  of  an  accident  due  to  failure  of  just  the  jtl1  element* 
Probability  that  element  j falls 

Probability  of  an  accident  given  that  the  j*'*1  element  fails. 


*In  this  and  subsequent  discussions,  unless  otherwise  stated,  expressions  such  as 
"failure  of  the  jth  element"  should  be  Interpreted  to  mean:  failure  of  only  the 
Jth  element,  assuming  all  other  elements  are  not  failed. 
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This  equation  reflects  the  basic  relationships  addressed  In  the  FSPT  where: 

a.  The  criticality  of  the  j**1  element  is  an  estimate  of  P(*f,  j) 

b.  The  sensitivity  of  the  element  is  an  estimate  of  P(»4|j) 

c.  The  failure  probability  of  the  j^1  element  is  an  assessment  of  P(j). 

Because  an  element's  effect  on  safety  may  depend  on  the  mission  phase  (see 
Section  3.2.1),  the  above  model  can  be  expanded  to: 


PM.j) 


N 


y pj#kp(*/,ij’k) 

pi 


where 


(2) 


N = Number  of  mission  phases 

p.  , - Probability  that  the  element  is  failed  in  the  k1*1  phase 

k 

P(^f|j,k)  = The  | element's  sensitivity  in  the  k phase. 

To  identify  the  importance  of  discrete  elements  to  aircraft  safety,  two  flight 
profiles  consisting  of  nine  distinct  phases  were  defined,  one  for  fixed-wing  and  the 
other  for  rotary-wing  aircraft.  The  phases  are  discussed  in  Section  3.2. 1. 

To  utilize  equation  1,  it  was  necessary  to  develop  a method  for  obtaining  the 
values  of  P(^f|.i,k),  the  probability  that  a malfunction  in  element  j during  mission  \ 

phase  k will  result  in  an  accident.  This  method  in  turn  requires  the  estimation  of  two  ; 

parameters:  the  probability  of  accident  if  a major  function  is  not  available  during 
each  mission  phase,  and  the  dependence  of  the  major  function  on  subfunctions  and 
elements  during  each  such  phase.  * Each  function  and  equipment  item  thus  derives  its 
sensitivity  value  from  its  relationship  to  the  major  function(s)  dependent  upon  it. 

2.3  SENSITIVITY  ASSIGNMENTS 

A great  deal  of  information  is  available  on  the  causes  of  aircraft  accidents,  but 
little  exists  from  which  to  make  the  sensitivity  assignments,  P(l/f|j).  These  assign- 
ments are  therefore  largely  subjective,  based  on  the  analyst's  knowledge  of  the  sys- 
tem and  any  information  he  may  have  on  previous  accident  history.  The  sensitivity 
assignments  are  reviewed  (and  revised  as  necessary)  bv  an  Air  Force/contractor 
team  working  on  a particular  model  to  ensure  that  consistent  criteria  have  been  fol- 
lowed. The  team  review  and  negotiation  of  sensitivity  assignments  are  the  mechanism 
by  which  the  value  becomes  sufficiently  objective  for  use  with  the  model.  This 
negotiation  considers  all  of  those  top  level  functions  as  a group,  and  reassigns 
sensitivity  values  as  necessary  to  assure  that  the  most  objective  proportionality  is 


♦For  a more  detailed  discussion  of  the  mathematics  of  the  FSPT,  see  Appendix  B. 
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attained  for  the  particular  aircraft  model.  The  same  major-function  sensitivity  values 
are  used  for  major  functions  on  all  aircraft  models  where  configuration  and  mission 
profiles  permit. 

The  development  of  criticality  rankings  for  the  various  elements,  or  j's,  is 
dependent  upon  the  ability  to  quantify  the  failure  probability,  P(j),  and  the  element 
sensitivity,  P(«/f|j),  for  each  element.  Since  the  intent  of  the  concept  is  to  provide  a 
relative  safety  ranking  of  all  malfunctions,  it  is  not  necessary  to  develop  absolute 
values  for  P(,/f|j).  If  the  sensitivity  values  developed  are  correct  relative  to  each 
other,  a proper  criticality  ranking  will  be  established.  It  is  Intended  that  criticality 
be  an  index  proportional  to  P(^f,j)  and  therefore  provide  the  same  relative  rank  order- 
ing of  elements.  The  major  reasons  for  proportionality,  rather  than  equality,  are: 

a.  The  FSPT  does  not  account  for  the  effect  of  extraordinary  pilot 
intervention  to  prevent  an  accident  in  case  of  equipment  malfunction. 

b.  Criticality  quantification  was  limited  in  its  treatment  of  simultaneous 
occurrence  of  independent,  primary  failures. 

While  strict  proportionality  cannot  be  mathematically  proven,  it  is  believed  that 
the  criticality  rankings  provide  reasonable  relative  measures  of  equipment  problem 
potential. 
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MODEL  DEVELOPMENT 
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Figure  3-1  summarizes  the  approach  to  the  assessment  of  flight-safety 
criticality  of  aircraft  equipment.  Both  the  Air  Force  and  contractor  participate  in 
this  assessment.  The  first  contractor  activity  is  the  identification  of  all  functions 
that  the  aircraft  is  expected  to  perform  and  the  determination  of  their  interrelation- 
ships. Next,  each  functional  relationship  is  documented,  and  then  sensitivity  assign- 
ments are  made  at  the  major  functional  levels.  (Below  these  levels,  link  dependency 
values  are  estimated;  see  Section  3.  2.  2.)  This  process  is  carried  out  until  each  work 
unit  code  (WUC)  associated  with  a major  function  has  been  identified  with  respect  to 
the  function  performed,  and  dependencies  have  been  estimated.  Computer  processing 
procedures  calculate  the  safety  sensitivity  for  each  WUC  item,  combine  these  values 
with  the  operation  and  failure  data  input  by  the  Air  Force,  and  produce  the  equipment 
criticality  ranking. 

The  above  comments  and  relationships  hold  for  both  fixed  wing  and  rotary  wing 
aircraft.  As  will  be  shown  in  the  following  sections,  a number  of  modifications  in  the 
areas  of  functional  analysis  and  major  function  sensitivity  assignment  were  necessary 
to  adapt  the  model  to  accommodate  rotary  wing  aircraft.  The  modifications  were  made 
to  address  the  different  physical  characteristics  and  flight  modes  of  the  rotary  wing 
aircraft. 


Figure  3-1.  Activities  and  Data  Inputs  to  Flight  Safety  Criticality  Assessment 
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3.1  FUNCTIONAL  ANALYSIS 


Functional  analysis  entails  the  systematic  identification  of  the  relationships  of 
hardware  to  the  functions  performed  by  the  aircraft  as  documented  in  the  aircraft 
Technical  Orders.  Tabulated  for  each  aircraft  function  are  the  equipments  necessary 
for  its  performance  as  well  as  all  outputs  required  for  other  systems.  The  complexity 
of  the  functional  interdependencies  of  an  aircraft  requires  the  use  of  a systematic 
accounting  procedure,  as  discussed  below,  to  assure  that  all  relationships  have  been 
identified  and  that  no  functional  paths  have  been  overlooked. 

Certain  top-level  or  primary  functions  are  applicable  to  all  aircraft  types,  both 
fixed  and  rotary  wing,  and  serve  as  the  basis  for  a safety  analysis.  As  shown  in 
Figure  3-2,  the  basic  differences  between  fixed  and  rotary  wing  aircraft  are  evidenced 
at  the  second  or  major-function  level. 

Below  the  major  function  level,  the  functional  identification  and  structure  are 
tailored  to  the  particular  equipment  and  functional  relationships  unique  to  the  aircraft 
modeled.  In  Figure  3-2b,  for  example,  the  major  function  "Main  Rotor  Controls"  is 
subdivided  into  "Cyclic  Controls"  and  "Collective  Controls".  This  structure  is  that 
applicable  to  a UH-1N  aircraft  in  which  cyclic  controls  provide  primary  aerodynamic 
life,  and  collective  controls  provide  pitch  and  roll  movements.  Finally,  each  item  in 
the  aircraft  WUC  ("-Ofi")  manual  is  identified  with  respect  to  the  function  it  performs.  * 

Except  as  noted  above,  documentation  for  a rotary  wing  aircraft  can  be 
accomplished  just  as  for  a fixed  wing  aircraft.  Every  function  and  every  WUC  included 
in  the  model  receives  an  "alpha  designator"  unique  to  that  aircraft  model.  Because  of 
the  large  number  of  alpha  designators  required  in  a model,  an  indenturing  system  is 
utilized  to  prevent  duplication.  However,  the  location  in  the  hierarchical  structure 
and  the  number  of  characters  in  the  alpha  designators  often  do  not  correlate,  since 
correlation  is  not  necessary  for  subsequent  processing. 

The  functional  relationships  from  the  system  diagram,  and  identification  of  the 
equipment  necessary  for  each  function,  are  next  documented  in  an  80-column  punch- 
card  format  (see  Appendix  C).  The  total  functional  diagram  for  the  aircraft  is  then  a 
compilation  of  the  system  diagrams,  with  one  punchcard  for  each  functional  link. 

With  the  aircraft  functions  completely  documented,  the  functional  paths  by  which 
a piece  of  equipment  contributes  to  the  operation  of  the  aircraft  can  be  identified  by 
computer.  Performing  the  path-identification/documentation  task  by  computer  proves 
to  be  not  only  useful  but  necessary  - the  human  analyst  could  neither  keep  track  of  nor 
assign  sensitivity  values  to  all  functional  paths.  The  machine  processing  capability 
allows  the  analyst  to  consider  only  one  functional  link  at  a time.  The  ability  to  follow 
all  of  the  functional  interrelationships  within  the  aircraft,  which  is  necessary  for 
meaningful  assessment  of  safety,  is  then  provided  by  the  computer. 


‘Certain  WUC  items  in  the  "-00"  manual  may  not  be  included  in  the  safety  model,  these 
items  being  either  1)  eliminated  by  TCTOs,  2)  purely  structural  items  in  the 
11000  series,  3)  necessary  only  for  survivability  or  ejection,  or  4)  of  lower  indenture 
than  the  LRU  level,  where  computer  data  screening  eliminates  failure  reports. 


b.  Rotary  Wing  Aircraft  Functions 


Figure  3-2.  Hierarchical  Structure  of  Aircraft  Functions 
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3.2  MAJOR- FUNCTION  SENSITIVITY  ASSIGNMENT 
3.2.1  Assignment  Method 

As  stated  earlier,  the  sensitivity  of  a function  or  equipment  item  is  an  estimate 
of  the  probability  that  its  failure  will  cause  an  accident.  From  functional  analysis  of 
the  aircraft  under  consideration,  major  functions  are  identified  and  are  assigned 
sensitivity  values  for  each  phase  of  the  mission. 

The  relative  Importance  of  primary,  major,  and  other  functions  is  not  nec- 
essarily constant  throughout  a flight.  The  failure,  for  example,  of  one  engine  of  a 
multi-engine  aircraft  is  far  more  critical  on  takeoff  than  it  is  during  the  rest  of  the 
flight,  and  is  of  relatively  little  importance  during  startup  and  taxi.  To  accommodate 


this  variability  of  importance,  the  mission  of  an  aircraft  is  divided  into  nine  flight 
phases,  which  for  fixed  wing  aircraft  are  as  follows: 


Phase 

Description 

1. 

Startup  and  taxi 

After  engine  rotation  and  prior  to  assuming 
takeoff  heading  on  runway. 

2. 

Takeoff 

After  assuming  takeoff  heading;  roll  on 
runway;  and  prior  to  gear-up. 

3. 

Climb 

From  gear-up  to  attainment  of  cruise 
altitude. 

4. 

Cruise  outbound 

From  the  end  of  climb  to  initiation  of 
tactical  phase. 

5. 

Tactical 

Performance  of  operations  uniquely  identi- 
fied with  the  aircraft  mission,  such  as 
gunnery,  air-to-air  intercept,  stores 
release,  cargo  drop,  etc. 

6. 

Cruise  return 

After  achieving  recovery  heading  and  prior 
to  descent-power  reduction. 

7. 

Descent 

From  descent-power  reduction  to  break  or 
localizer  engage  homing  point. 

*. 

Landing 

From  break  or  localizing  engage  homing 
point  through  stop  or  runway  turnoff. 

9. 

Taxi  and  shutdown 

From  runway  turnoff  to  engine  stop. 

These  phases  are  illustrated  in  Figure  3-3a. 
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The  foregoing  mission  phases  do  not  adequately  address  the  flight  conditions 
encountered  during  rotary  wing  flight,  particularly  that  of  hovering.  The  nine  phases 
defined  for  rotary  wing  aircraft  are  as  follows: 


. 

Phase 

Description 

1. 

Startup  (and  taxi  for 
wheeled  helicopters) 

After  engine  rotation  and  prior  to  liftoff. 

2. 

Hover  out  (airborne  taxi) 

From  liftoff  to  commencement  of  takeoff 
run. 

3. 

Takeoff 

From  commencement  of  takeoff  run  through 
translation  lift. 

4. 

Climb  out  and  cruise 
outbound 

After  translational  lift  through  cllmbout 
and  cruise  to  tactical  site.  For  non- 
tactlcal  missions,  this  includes  the  first 
half  of  the  at-altitude  flight. 

5. 

Tactical 

From  arrival  at  tactical  site  to  assumption 
of  heading  and  altitude  for  return  cruise. 

6. 

Cruise  return  and 
descent 

From  assumption  of  return  heading  to  speed 
reduction  in  preparation  for  landing.  For 
nontactical  missions,  this  identifies  the 
last  half  of  the  at-altitude  flight. 

7. 

Landing  to  hover 

From  speed  reduction  in  preparation  for 
landing  to  termination  of  descent  at  a 
hover. 

8. 

Hover  in 

From  landing  termination  to  touchdown. 

9. 

Shutdown  (Includes  taxi-in 
for  wheeled  helicopters) 

From  touchdown  to  engine  stop. 

These  phases  are  Illustrated  in  Figure  3-3b.  By  maintaining  a total  of  nine 
flight  phases,  the  model  input-punchcard  format  remains  the  same  as  for  fixed  wing 
aircraft. 


For  both  aircraft  types  (fixed  and  rotary  wing),  a sensitivity  value  is  assigned 
for  each  phase,  representing  the  best  estimate  of  the  likelihood  that  the  aircraft  will 
enter  a hazardous  mode  if  the  function  Is  not  present  in  that  phase.  The  numerical 
values  assigned  are  proportional  rather  than  absolute,  and  range  from  0.0  to  1.0. 
The  keypunch  card  limits  this  assignment  to  Increments  of  0. 1.  Increments  smaller 
than  0. 1,  when  required,  are  assigned  by  defining  a quasi-function  for  insertion 
between  the  major  function  and  its  dependent  primary  function. 
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b.  Rotary  Winn  Aircraft  Mission 


Figure  Phases  of  Aircraft  Mission 


3.2.2  Link  Dependency  Assignment 

Link  dependency  Is  defined  as  the  probability  that  the  loss  of  a function  will 
result  In  the  loss  of  a dependent  function.  (For  a more  detailed  discussion  of  this 
term,  see  Appendix  B.)  The  assignment  of  link  dependency  values  requires  knowledge 
of  the  operation  of  specific  aircraft  because  It  Is  concerned  only  with  functional  levels 
below  the  "major"  category.  At  this  lower  level,  no  evaluation  is  made  of  the  impact 
on  flight  safety  of  the  loss  of  functions,  and  no  special  procedures  are  required  to 
accommodate  rotary  wing  aircraft.  Instead,  the  effect  of  the  loss  of  one  function  on 
the  performance  of  another  function  becomes  the  evaluation  criterion. 

Like  sensitivities,  link  dependency  values  are  assigned  In  increments  of  0. 1, 
Additionally,  the  method  of  attenuation  used  In  assigning  sensitivity  values  can  also  be 
applied  to  link  dependencies. 

3.2.3  Provisory  Factors 

The  sensitivity  of  major  functions  with  respect  to  aircraft  safety  - and  at  the 
lower  levels,  the  link  dependency  between  functions  — can  be  dependent  on  external 
influences  and  aircraft  operating  conditions.  To  accommodate  these  external 
influences,  a set  of  provisory  factors  has  been  identified.  An  example  would  be  a 
windshield  anti-ice  system,  which  has  a safety  sensitivity  close  to  1.0  during  landing 
under  icing  conditions  but  a negligible  effect  on  a dry,  warm  day. 

Under  such  circumstances,  the  procedure  is  to  assign  the  worst-case  value 
(assuming  the  condition  exists).  During  model  exercise  the  likelihood  that  the  con- 
dition exists  can  be  "read-in”,  thereby  allowing  the  sensitivity  value  to  be  assigned  by 
the  computer  based  on  the  likelihood  of  the  condition  and  the  probability  that  the  higher 
level  function  will  therefore  be  lost.  For  the  rotary  wing  safety  model,  one  provisory 
factor  was  redefined  (from  its  fixed  wing  form)  to  accommodate  unique  helicopter 
operating  conditions.  This  factor  is  identified  as  Code  C,  in  Table  3-1,  which  lists 
the  standard  provisory  factors  used  in  FSPT  models.  The  specific  use  of  the  pro- 
visory factor  B as  applied  to  helicopters  refers  to  operations  in  that  portion  of  the 
flight  envelope  where  auto-rotation  is  not  available  as  a backup  to  the  propulsion  and 
auto-torque  functions. 

3.2.4  Computer  Processing 

For  any  aircraft,  the  documentation  of  a flight  safety  analysis  by  AR1NC 
Research  consists  of  functional  diagrams,  coded  functional  tabulations,  a functional 
data  processing  card  deck,  and  a machine-prepared  printout  of  the  card  deck  data. 
Under  this  contract  the  documentation  is  then  sent  to  San  Antonio  Air  Logistics 
Center  (SA/ALC). 

SA/ALC  processes  the  functional  data  card  deck  through  a series  of  computerized 
operations,  as  follows: 

a.  A functional  deck  edit  is  accomplished  to  Identify  format  or  logic  errors. 

b.  A path  identification/documentation  run  is  made  that  traces  all  possible 
paths  associated  with  each  function  and  calculates  the  numerical  sensi- 
tivities by  flight  phase  down  to  the  WUC  level. 

c.  A path  combination  run  is  made  taking  into  account  the  dependence  of 
more  than  one  major  function  on  a particular  WUC. 
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d.  Failure  information  from  the  fifi-l  data  system  and  numerical  factors  for 
provisory  conditions  are  input,  and  a WUC  criticality  list  by  rank  order 
is  generated  by  the  computer. 


Since  no  change  in  card  format  of  other  documentation  methods  is  necessary  for 
rotary  wing  application,  no  computer  programming  changes  were  necessary. 


An  additional  product  generated  by  the  computer  is  a two-part  criticality  trend 
analysis.  Part  1 contains  the  criticality  rankings  and  linear  regression  analysis  by 
WUC  for  the  previous  12  months.  Part  II  contains  plots  of  the  criticalities  and 
regression  lines  for  the  2.r>  WUCs  top-ranked  according  to  safety  criticality. 


TABLE  3-1.  PROVISORY  FACTOR  CODES 


Provisory  Condition 


icing  conditions 

Adverse  speed/altitude  operations 


Runway  stopping  distance  (fixed  wing) 
Confined  area  operations  (helicopter) 


Night  operation 


IFR  conditions 


Supersonic  flight 


Solo  flight 

Loss  of  function  for  which  indication  is  provided 
Normal  system  failed 


Flame-out 


Cold  weather 


One  of  three  available  units  is  required 
Two  of  three  available  units  are  required 
One  of  four  available  units  is  required 
Two  of  four  available  units  are  required 
Three  of  four  available  units  are  required 
Four  of  eight  available  units  are  required 


3.2.5  Model  Maintenance 


Each  time  an  aircraft  typo  for  which  a safety  model  has  been  developed  under- 
goes a modification,  the  effects  of  the  changes  on  the  model  must  he  evaluated. 
Technical  order  anti  WUC  revisions  must  be  incorporated  into  the  model.  Removal  of 
existing  hardware,  installation  of  new  hardware,  or  design  improvements  may  change 


link  dependencies  and  sensitivity  assignments.  The  update  procedure  should  follow 
the  same  general  steps  as  outlined  for  the  initial  analysis  effort. 

Existing  block  diagrams  and  a printout  of  the  functional  card  deck  form  the 
baseline  for  change  identification.  Functional  relationships  should  be  reviewed  to 
determine  the  impact  of  changes  on  the  documented  safety  analysis.  Diagrams  should 
be  revised  to  reflect  functional  differences,  WUC  changes  should  be  noted,  and  all 
differences  listed  on  a flight-safety  functional  tabulation  sheet.  The  functional  deck 
printout  can  be  used  for  manual  indication  of  what  the  changes  are  and  where  they 
occur.  New  data  cards  are  prepared  and  the  functional  deck  updated  by  the  removal  of 
obsolete  cards  and  the  insertion  of  new  cards.  From  this  point  on,  the  computer  is 
again  utilized  to  edit  the  functional  deck,  perform  path  identification/documentation, 
and  calculate  sensitivities  for  each  WUC. 

Rlock  diagrams  and  other  affected  portions  of  the  specific  aircraft  safety 
analysis  report  should  be  updated  and  revised  pages  issued  that  reflect  these  changes. 
Maintaining  an  accurate  and  updated  model  is  important  to  obtaining  an  accurate 
assessment  of  the  safety  significance  of  hardware  failures. 
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UH-1N  MODEL  DEVELOPMENT 


An  FSPT  model  for  the  PII-1N  helicopter  was  developed  to  evaluate  the 
feasibility  of  applying  the  modeling  methodology  to  rotary  wing  aircraft.  The  Initial 
step  was  a review  of  the  basic  FSPT  model  for  any  inconsistencies  that  would  affect 
the  adaptation  to  rotary  wing  application.  Next,  the  flight  phases  were  reviewed  and 
redefined  in  accordance  with  helicopter  flight  operations.  Allowances  were  made  for 
hover  flight,  and  for  the  differences  in  takeoff/Ianding  flight  characteristics  between 
rotary  and  fixed  wing  aircraft.  New  and  revised  provisory  factors  were  incorporated 
for  extreme  rotary  wing  flight  conditions  (l.e. , high  altitude  lv  or,  confined  area 
flight  maneuverability)  where  recovery  from  a system  failure  Is  less  likely.  The  total 
aircraft  do*  umentatlon  was  submitted  for  "GO  95"  computer  edit  at  SA/Al.C  in 
July  1975. 

The  aircraft  flight  manual  and  maintenance  technical  orders  provided  the  infor- 
mation on  aircraft  system  operation.  The  model  developed  represents  the  UH-1N 
helicopter  configured  to  the  latest  TCTOs  documented  in  the  manuals  supplied  by 
SA/AI.C.  Table  *1-1  lists  the  manuals  and  their  revision  status  applicable  to  the 
developed  model. 

The  UH-1N  safety  model  was  developed  by  A RING  Research  for  all  systems  of 
the  aircraft.  Although  the  UII-1N  is  a fixed-skid  aircraft,  landing  gear  and  ground 
control  were  included  ns  primary  functions  to  ensure  consistency  with  the  previous 
FSPT  models  and  establish  the  precedence  for  the  modeling  of  wheeled  rotary  wing 
aircraft. 

Because  of  the  vulnerability  of  the  functional  loglc/senslttvlty  documentation  of 
such  errors  as  omission  of  links,  duplication  of  cards,  and  keypunching,  quality 
reviews  were  conducted  at  various  critical  points  in  the  model  development.  Kach 
card  was  checked  against  the  functional  links  of  the  diagrams  to  assure  accuracy  and 
completeness.  Work  unit  codes  used  in  the  model  were  checked  against  the  WPG 
manual  to  assure  completeness. 

Appendix  C presents  the  methods  and  standards  used  in  documenting  an  FSPT 
aircraft  model.  Appendix  I)  presents  the  FSPT  documentation  for  the  UI1-1N 
helicopter. 


TABLK  4-1.  U1I-1N  IIKIJCOPTKR  SYSTFM  BOCUMFNTATION 


Nomenclature 

Title 

Revision/Pnte 

T.O.  1H-1(U)N-1 

T.O.  lH-l(U)N-2-l 

T.O.  lH-l(U)N-0fi 

Flight  Manual 

Organizational  Maintenance 

Work  Unit  Code 

Change  3/20  Jan  75 

Change  11/25  Apr  75 

Change  1/s  Apr  75 
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HISTORICAL  SUMMARY  OF  FSPT 


In  1965,  the  desirability  and  practicability  of  quantifying  the  significance  of 
specific  equipment  malfunctions  relative  to  flight  safety  was  explored  in  a feasibility 
study  conducted  by  ARINC  Research  Corporation  for  the  Air  Force.  The  feasibility 
of  a safety-quantification  approach,  which  has  subsequently  become  known  as  Flight 
Safety  Prediction  Technique  (FSPT),  was  demonstrated;  and  the  method  was  developed 
and  refined  in  a series  of  studies,  as  follows: 


Study 

Phase  Subject/Datc  Sponsor*/Publlcatlon  No. 


I Feasibility  Study, 

September  19(55  to 
June  1967  (Phase  0 

II-A  Technique  Development, 

October  1967  to 
July  1968  (Phase  II-A) 

II-B  Technique  Development, 

July  1968  to  July  1969 
(Phase  II-B) 


Sacramento  Air  Materiel  Area  (SMNE), 
Contract  AF09(603)62335,  SM-67-2; 
publication  705-01-1-777 

San  Antonio  Air  Materiel  Area  (SANKW), 
Contract  AF09(603)-67-A-0267-SA01; 
publication  734-01-1-895 

San  Antonio  Air  Materiel  Area  (SANKW), 
Contract  F09(603)-68-A-0317-SA01; 
publication  754-01-1-985  (Revision  1) 


FSPT  System  Documen-  San  Antonio  Air  Materiel  Area  (MMER) 
tatlon  for  the  F-4C  and  Contract  F41608-71-C-0576; 

T-37  Aircraft,  October  publication  697-01-1-1118 
1970  to  June  1971 


In  the  Phase  II-B  study,  the  FSPT  was  applied  to  the  F-106  aircraft.  Con- 
current with  Phase  II-B,  the  U.S.  Naval  Safety  Center  contracted  ARINC  Research  to 
extend  the  methodology  to  produce  a flight  safety  criticality  model  for  the  F-4J  air- 
craft. The  results  of  this  effort  are  documented  in  ARINC  Research  Publication 
753-01-3-982  (Revision  1). 


In  1970,  ARINC  Research  was  contracted  to  develop  suitable  input  data  to  per- 
mit the  application  of  the  technique  to  the  T-37  and  F-4C  aircraft.  These  data  were 
derived  in  the  form  of  mathematical  model  functional  documentation  as  input  to  the 
basic  computer  program  developed  and  applied  to  the  F-106. 

In  1972,  ARINC  Research  Corporation  was  awarded  a contract,  with  the  sub- 
sequent modifications  in  1973  and  1974,  to  apply  the  Flight  Snfety  Prediction 
Technique  to  15  aircraft,  working  jointly  with  cognizant  Air  Logistics  Centers.  Air- 
craft to  which  the  FSPT  has  been  applied  under  this  latter  contract  (F09603-72-A- 
1132-SA01)  include: 

a.  T-38 

b.  F-111A  and  FB-111A 


*The  office  symbols  of  Service  Engineering  at  the  Sacramento  and  San  Antonio  Air 
Materiel  Areas  are  now  SM/ALC/MME  and  SA/ALC/MME,  respectively. 
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c.  A-7D 

d.  F-4D,  E;  RF-4C 

e.  C-141 

f.  A -37 
R.  0-2 

h.  OV-IO 

i.  B-52G,  H 

j.  C-130E 

k.  KC-135 

i.  c-nA 

m.  T-39 

n.  F-15 

o.  UH-1N  Helicopter* 


♦Feasibility  study  of  adaptation  of  FSPT  to  rotary-wing  aircraft. 
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FORMULATION  OF  CRITICALITY-ASSESSMENT  TECHNIQUE 


To  implement  the  basic  safety  model  defined  in  Section  2. 2,  it  is  necessary  to 
develop  a submodel  for  the  probability  that  a malfunction  in  element  J during  mission 
phase  k will  result  in  an  accident.  This  submodel  in  turn  requires  that  we  estimate 
two  parameters:  the  probability  of  accident  if  a major  function  is  not  available  during 
each  mission  phase,  and  the  dependence  of  the  major  function  on  element  j during  each 
mission  phase. 

The  first  parameter  is  termed  "functional  sensitivity"  and  is  estimated  for  each 
major  function.  The  functional  analysis  performed  in  this  task  established  for  an 
aircraft  the  following  hierarchal  scheme: 

Aircraft 

Primary  functions 
Major  functions 
Function 
Elements  (Work  Unit  Codes) 

A primary  function  would  be  one  such  as  Flight  Control.  Major  functions  under 
Flight  Control  would  include  Pitch  Control  and  Yaw  Control. 

The  second  parameter,  "link  dependency,"  is  a vehicle  for  showing  the  influ- 
ence of  each  functional-path  element  on  the  performance  of  a major  function.  For 
example,  if  the  major  function  being  considered  is  External  Lighting,  the  following 
diagram  illustrates  the  nature  of  functional  sensitivity  and  link  dependency  values. 


* Link  dependencies 

* Functional  sensitivity 


The  0.8  value  means  that  failure  of  the  Control  function  will  result  in  loss  of  the 
Landing  Light  function  80%  of  the  time.  The  0. 1 functional  sensitivity  value  denotes 
that  loss  of  external  lighting  will  result  In  an  accident  10%  of  the  time.  The  values 
must  be  interpreted  in  a proportional  sense,  in  that  the  actual  accident  probability  is 
dependent  upon  external  factors  (see  Section  3.2.3). 
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The  remainder  of  this  appendix  discusses  the  procedures  and  model  used  to 
obtain  element  sensitivities;  e.g. , in  the  above  example,  the  accident  probability 
given  that  a Work  Unit  Code  in  the  Control  function  malfunctions. 

Three  principal  types  of  functional  relationship — series,  redundant,  and 
parallel— were  identified  as  representing  the  major  forms  to  consider  in  modeling 
element  sensitivity. 

Series  Relationship  - A function  having  only  one  input.  Schematically, 


which  indicates  that  outside  of  its  own  elements,  the  success  of  function  B is  only 
affected  bv  the  success  of  function  A. 

Functional  Redundancy  — A function  having  one  or  more  backup  functions  that 
can  provide  the  required  inputs  to  successor  functions.  Schematically, 


where  Aj  and  A2  represent  a functional  redundancy  in  that  either  may  provide  the 
necessary  input  to  B. 

Parallel  Functions  — Two  or  more  functions  independent  of  each  other  in  terms 
of  functional  success,  hut  each  of  which  may  be  required  for  a successor  function. 
Schematically, 


B will  generulh  require  both  Aj  and  A^  ; hut  Aj  does  not  depend  on  A2  . nor  does 
Ao  depend  on  Aj  . 

Jn  some  eases  the  distinction  between  functional  redundancy  and  parallel  paths 
is  very  slight,  and  may  depend  on  mission  phase.  For  example  the  four  engines  of  a 
plane  can  be  considered  to  be  a redundant  configuration  providing  inputs  to  the  pri- 
mary propulsion  function  during  cruising,  but  would  generally  be  considered  to  be 
parallel  functions  during  takeoffs  requiring  full  power. 
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In  general,  given  a schematic  relationship  of  the  form, 


we  can  say  that  A and  B are  In  a functionally  redundant  configuration  If  the  success 
probability  of  C Is  the  same  If  1)  A and  B are  successful,  2)  A only  Is  successful, 
or  3)  B only  Is  successful.  If,  for  example,  C Is  more  likely  to  be  successful  If  both 
A and  B are  successful,  rather  than  A or  B alone,  then  the  relationship  is  one  of 
parallel  paths. 

It  is  noted  that  the  model  will _also  account  for  element  redundance  and  parallel 
elements  through  Inputs  such  as  P(A|la),  representing  the  probability  that  the  Ath 
function  falls  given  that  the  ia^  element  in  A has  failed.  If  la  is  a parallel  element, 
the  probability  would  depend  on  mission  requirements  and  other  parallel-element 
states. 

Link  dependency  is  the  conditional  probability  of  a functional  failure,  given  the 
failure  of  immediate  predecessor  functions.  The  link  dependencies  applicable  to  the 
three  basic  designs  defined  above  are  shown  below. 

Series  Relatlonshl 


We  shall  generally  assume  that  the  dependencies  of  Bj  with  respect  to  A,  and  of 
B2  with  respect  to  A , are  independent  of  each  other,  so  that 


P(BjB2|X)  P(Bj|A)Pm2lX) 


We  then  can  consider  three  link  dependencies  from  A to  B as  follows: 


noting  that 


Models  are  shown  below  for  determining  the  sensitivity  of  elements  within  a 
function  for  each  of  the  three  basic  designs.  The  following  basic  assumptions  apply: 

a.  Except  for  cases  where  an  element  has  a redundant  or  parallel  counterpart 
or  is  located  in  a function  with  a redundant  or  parallel  function,  only  the 
element  under  consideration  shall  be  assumed  to  have  failed  initially.  Thus 
the  expression  P(/f  li-),  representing  the  accident  probability  given  failure 
of  the  i^1  Work  Unit  Code  element,  is  based  on  the  assumption  that  no  other 
element  has  failed  unless  element  i is  in  some  redundant  or  parallel  con- 
figuration. For  cases  in  which  there  are  redundant  or  parallel  counter- 
parts, failures  of  such  counterpart  elements  or  functions  are  considered  in 
accordance  with  their  occurrence  probabilities. 

b.  The  success  of  all  immediate  predecessors  ensures  the  success  of  a func- 
tion, provided  that  the  function  experiences  no  element  failures.  Thus  for 
the  series  function  relationship 


we  assume 

pibIa)  o, 

provided  B experiences  no  element  failures.  If  an  element  in  function  A 
is  under  consideration,  the  latter  provision  is  always  true  by  assumption 
"a." 

The  element  sensitivity  models  are: 

Series  Relationship 


P(-f|la)  = P(A|  ia)P(B|  A)  P(C|  B>P(^|C> 
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Functional  Redundancy 


B 


l I 

P(^|1J  = P(A|ijP(B|A)P(ClB)P(^f|C) 

fl  3 

p(-f  l‘bi)  = P^jl  ibl)P(^2)P(^H)P(^l  C) 


Parallel  Functions 


P(jt  I i ) = P(  A |i  ) { P(  B('|  A)  P(  I)  | BC)  • P(BC|A)P(D|BC) 

3 3 

• P(BcIa)P(I)Ibc)}  P(^flT)) 

P(^flu  --  P(B|i.){P(rlih)P(DlBC)  - P(C|ib)P(OlBC)}P^#|D) 


I 


1 


A case  not  explicitly  Incuded  In  the  above  three  basic  functional  relationships  is 
one  for  which  a function  is  in  two  paths,  e.g. , 


then 

P(jf|i)  - P(C|i)P(B|iJP(^|CB)  * P(C|l)P(l|i  )P(^|CB) 

3 3d  d d 

♦ P(C I i )P(B |i  ) { 1 - P<3#|C)P(3|B)} 

3 d 


where  it  is  assumed  that  the  effects  of  loss  of  the  major  functions  in  accident  occur- 
rence are  independent  of  each  other. 


Use  of  Numerical  Provisory  Factors  for  Partially  Redundant  Systems 

The  numerical  provisory  factors  (see  Table  3-1)  are  used  where  more  than  two 
identical  functions  are  involved  in  a redundancy.  For  example,  aircraft  with  more 
than  two  engines  often  have  identical  and  independent  systems  for  hydraulic  pressuri- 
zation, and  for  electrical  power  generation,  one  driven  by  each  engine.  If  the  aircraft 
can  be  operated  safely  with  one  or  more  of  such  systems  in  a failed  state,  one  of  the 
numeric  codes  is  utilized  in  assigning  link  dependency  values.  Consider,  for  example, 
the  following: 

If  N identical  and  independent  units*  are  available  and  at  least  M are  required 
for  safe  operation,  where  0<M<N,  then  the  provisory  factor  of  a given  unit,  sav  1'j-  is 
the  probability  that  the  failure  of  Uj  will  cause  the  aircraft  to  enter  an  unsafe  state. 
This  is  the  probability  that  exactly  M-l  of  the  remaining  N-l  units  will  be  in  an 
unfailed  state.  This  probability  can  be  calculated  by  the  formula  for  the  binomial  dis- 
tribution, and  is  given  by 


where  P(Uj)  = probability  that  failure  of  the  unit  will  cause  the  aircraft  to  enter 
an  unsafe  state,  and 

M = Number  of  units  required 
N = Number  of  units  available 

p = Probability  that  a single  unit  will  be  in  an  unfalled  state 
q = Probability  that  a single  unit  will  be  in  a failed  state  or  (1-p) 


•Units  may  be  either  elements,  element  assemblies,  or  functions. 
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Assignment  of  link  dependencies  to  V Identical  and  independent  units  of  which 
only  M are  required  proceeds  as  follows.  The  value  assigned  to  each  unit  is  the 
dependency  of  the  higher  level  function  on  receiving  an  output  from  M of  the  units 
(usually  1.0).  The  provisory  factor  is  the  appropriate  numeric  code.  In  the  evaluation 
of  the  path  sensitivity,  the  computer  is  programmed  to  select  the  binomial  formula  that 
corresponds  to  the  provisory  factor  listed. 
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FSPT  DOCUMENTATION  METHODS 

Because  of  the  extreme  complexity  of  aircraft,  It  is  necessary  to  develop  a 
computerized  method  to  identify  and  document  all  possible  paths  associated  with  each 
function  as  well  as  to  determine  the  safety  sensitivity  associated  with  each  path.  A 
computer  routine  has  been  devised  that  takes  the  data  from  the  functional  card  deck 
and  traces  and  documents  all  pnths.  For  each  WUC,  It  also  computes  the  flight-phase 
sensitivities  for  each  path  in  which  the  WUC  Is  present.  The  resulting  computer 
printout  provides  a combined  functional  path  sensitivity. 


C.  1 ALPHA  CODING 

As  each  system  of  the  aircraft  Is  functionally  diagrammed,  the  functional  blocks 
are  assigned  an  "alphn  code".  This  code  aids  the  analyst  in  the  bookkeeping  tasks  of 
functional  diagramming  and  provides  the  computer  with  an  identification  of  the  ele- 
ments to  be  processed.  For  standardization  among  aircraft,  nine  top-level  functions 
have  been  defined  and  each  has  been  assigned  an  inittnl  or  first-alpha  designator. 

Each  block  in  the  functional  diagram  carries  the  same  initial  alpha  as  the  top  level 
function.  Subsequent  letters  added  to  the  initial  alpha  uniquely  identify  each  block. 

The  only  restrictions  placed  on  the  assignment  of  alphn  codes  are  that: 

a.  All  characters  In  a code  must  be  a letter  of  the  alphabet,  and 

b.  The  maximum  number  of  characters  in  one  rode  is  seven. 


C.  2 ALPHA  CODING  AND  COMPUTER  PROGRAM  COMPATIBILITY 

Additional  rules  for  alpha  coding  required  to  obtain  the  desired  results  from 
computer  processing  include: 

a.  When  a WUC  item  operates  in  the  same  mode  to  perform  more  than  one 
function,  the  same  alphn  code  Is  used  in  each  application. 

b.  When  a WUC  item  operates  in  a different  mode  to  perform  each  of  more 
than  one  function,  a different  alpha  designator  Is  assigned  for  each 
operating  mode. 

C . 3 FUNCT  IONA  I , TA  BU I .A  T1  ON 

The  "Flight  Safety  Functional  Tabulation”  sheet  is  used  to  code  the  safety  model 
for  keypunching.  The  sheets  are  coded  ns  follows  (refer  to  Figure  C-l)  for  an 
example). 

a.  Columns  1 through  3.  Used  to  identify  the  nlrcraft  represented  by  the 
model.  For  certain  aircraft  modeled  under  this  contract  more  than  one 
model  — designation  series  MDS  - was  included.  For  instance,  a single 
functional  deck  was  created  for  four  MDSs  of  the  F-4  aircraft.  Cards 
with  "F4K"*  In  columns  1-3  were  common  to  all  aircraft.  For  example, 

* blank 


i 


[ 
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when  these  cards  are  combined  with  those  carrying  "F4E"  In  columns 
1-3,  then  It  produces  an  F-4E  FSPT  model  deck. 

b.  Columns  4 through  31.  Contain  the  title  of  the  function  or  the  WUC  Item. 

c.  Columns  32  through  36.  Contain  the  left-justified  WUC  number. 

d.  Columns  37  and  3H.  Blank 

e.  Columns  39  through  46.  Contain  the  assigned  alphn  designator  for  the 
function  and/or  the  WUC.  Column  39  contains  either  an  L or  an  R,  or  Is 
blank.  The  L and  R designate  left  and  right  for  those  instances  when  the 
function  and/or  WUC  pertains  to  the  left  or  right  side  of  the  aircraft. 

f.  Columns  47  and  48.  Blank. 

K.  Columns  49  through  35.  Normally  left  blank,  but  are  used  after  a deck 
is  operational  to  substitute  the  data  on  a card  for  that  stored  in  the  com- 
puter by  punching  the  line  record  number  in  this  field. 

b.  Columns  56  through  63.  Identify  the  dependent  functions  for  either 
the  function  or  specific  WUCs  being  coded.  Column  56  may  contain 
L,  R or  blank  for  the  same  purpose  as  that  of  column  39. 

i.  Column  64.  Contains  the  alphanumeric  code  of  the  "provisory  factor" 
applicable  to  the  link  value  assigned. 

j*  Columns  65  through  69,  Contain  the  alpha  designator  of  a function  that  is 
an  alternate  for  the  function  being  coded.  (Column  65  is  used  for  "L"  or 
"R"  as  in  Column  39.)  The  presence  of  the  "alternate  alpha"  flags  the 
Importance  of  the  link  dependency  as  being  affected  by  the  success 
probability  of  the  alternate  function. 

k.  Column  70.  Contains  the  work  unit  code  dependency  value  (1  0. 10; 

2 0.20;  ....A  1.0).  This  value  is  applicable  to  all  flight  phases. 

l.  Column  71.  Contains  special  instructions  to  the  computer  through  the 
use  of  letters  F,  S,  or  being  blank.  Cards  with  an  "S"  or  "blank"  in 
column  71  are  used  in  sensitivity  computations.  Cards  with  an  "F" 
document  a functional  relationships  which,  although  present  in  the  sys- 
tem, would  produce  an  erroneous  sensitivity  value  when  combined  with 
other  nonindependent  paths  (having  the  same  function  in  common  at  some 
higher  level).  The  "F"  prevents  the  computer  from  including  the  link  in 
the  sensitivity  calculations. 

O'*  Columns  72  through  80.  Contain  functional  dependencies  for  each  of 
nine  flight  phases  as  described  in  Seotlon  3. 2. 1 of  the  text.  Coding  is 
the  same  as  for  column  70. 
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C.4  DIAGRAM  CONSTRUCTION 


The  diagrams  produced  under  the  contract  document  the  functional  Inter- 
relationship of  the  aircraft  systems  considered  in  the  model.  In  the  interest  of  extend- 
ing the  useful  life  of  the  diagrams,  WUC  items  are  not  shown,  thereby  eliminating  the 
necessity  of  updating  the  diagrams  with  each  (and  sometimes  frequent)  change  to  the 
WUC  manual. 

As  discussed  earlier  in  this  report,  the  diagrams  represent  the  hlerarchal 
structure  of  the  paths  from  which  the  sensitivity  values  are  derived.  The  diagrams, 
although  consistent  with  the  system  schematic  and  reliability  block  diagrams,  are  not 
equivalent  due  to  this  hlerarchal  method  of  documentation.  In  the  actual  system, 
signals  and/or  fluids  pass  from  one  component  to  the  next  and  are  thus  documented  in 
schematics;  conversely,  the  hlerarchal  approach  only  identifies  the  components  that 
must  operate  to  achieve  a given  function,  independent  of  the  direction  and/or  sequence 
of  signal  flow.  This  approach  directly  addresses  the  system  impact  of  a component 
failure  without  the  necessity  of  identifying  the  intrasystem  secondary  failures.  Each 
line  connecting  functions  on  the  diagram  is  documented  by  a punchcard,  with  the  lower 
fimction  providing  the  "alpha  designator"  and  the  higher  function's  alpha  designator 
indicator  as  the  "dependent  function".  * 
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FSPT  DOCUMENTATION  OF  UH-1N  AIRCRAFT 


This  appendix  contains  the  functional  relationship  diagrams  and  a listing  of  the 
keypunch  cards  that  comprise  the  FSPT  safety  model  documentation  for  the  UH-1N 
aircraft. 


D.l  DIAGRAMS 


The  diagrams  illustrating  the  functional  relationships  considered  in  the  UH-1N 
safety  model  are  presented  on  pages  D-5  through  D-19,  and  are  listed  below: 


Page 


Propulsion,  Diagram  B-l 
Propulsion,  Diagram  B-2 
Propulsion,  Diagram  B-3 
Comm/Nav/Ident,  Diagram  C-l 
Comm/Nav/Ident,  Diagram  C-2 
Information  and  Displays,  Diagram  D-l 
Information  and  Displays,  Diagram  D-2 
Environmental  Control,  Diagram  E-l 
Environmental  Control,  Diagram  E-2 
Flight  Control,  Diagram  F-l 
Flight  Control,  Diagram  F-2 
Ground  Control,  Diagram  G-l 
Mission  Support,  Diagram  M-l 
Landing  Gear,  Diagram  N-l 
Utilities,  Diagram  U-l 
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D.  2 CARD  LISTING 


Pages  D-21  through  D-54  are  a reproduction  of  the  punchcard  listing.  The 
listing  is  alphabetical  by  "alpha  designator",  and  the  format  is  that  of  the  80-column 
punchcard  itself  as  described  in  Appendix  C.  At  the  top  of  each  page  the  card  columns 
are  printed  vertically;  for  example,  column  34  is  printed  "3',< 
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